Hi all, Here is a set that enables checkpoint restore of the underlying eBPF programs that power seccomp filters via the API we discussed several months ago. A few notes:
* We expose prog_id in the ebpf dump as the pointer to the ebpf program in kernel memory, since this is unique. I'm not sure if this is safe. The goal of exposing prog_id is to enable userspace to figure out how the seccomp filters are inherited (i.e. is the filter a result of a fork() or an identical filter installed). This is relevant because SECCOMP_FILTER_FLAG_TSYNC depends on this ancestry. * I'm not sure what the fd argument to seccomp() should look like in the SECCOMP_FILTER_FLAG_EBPF case: it seems ugly either as &fd or fd; any thoughts on this are welcome. * Please double check the first patch. I'm not too framiliar with eBPF, so this is mostly monkey see monkey do. * The last patch is something I discovered while testing this set (I couldn't re-import some filters). I'm not sure if this is indicitave of a wider bug or if the fix is even correct but it Works For Me. Thoughts welcome, Tycho -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
